Microsoft Azure gives you powerful resilience primitives — Availability Zones, paired regions, Azure Site Recovery, immutable Backup vaults. But under Microsoft's Shared Responsibility Model, configuring and proving continuity is on you. This guide shows how to build a BCDR (Business Continuity & Disaster Recovery) program for Azure that holds up technically and in front of an ISO 22301, DORA or NIS2 auditor — with ResiPlan keeping the evidence current.
BCDR for Azure: two disciplines, one program
- Business Continuity (BC) keeps processes alive — people, decisions, communications, suppliers.
- Disaster Recovery (DR) restores systems and data.
Auditors reject DR that is bolted on as pure infrastructure. They want recovery objectives derived from a Business Impact Analysis (BIA) — driven by business criticality, not by which Azure SKU you happen to run.
Step 1 — Derive RTO/RPO, then pick the Azure DR pattern
Set RTO (tolerable downtime) and RPO (tolerable data loss) per process from a BIA, then map each tier to an Azure pattern:
| RTO / RPO tier | Azure DR pattern | Cost |
|---|---|---|
| RTO hours, RPO hours | Azure Backup with cross-region restore (GRS) | $ |
| RTO ~10s of min, RPO minutes | Pilot Light (replicated data, dormant infra via ARM/Bicep) | $$ |
| RTO minutes, RPO seconds | Azure Site Recovery (warm standby replication) | $$$ |
| RTO near-zero, RPO near-zero | Active/Active across paired regions (Front Door / Traffic Manager) | $$$$ |
Translate criticality into target tiers first with a free RTO/RPO calculator.
Step 2 — Availability Zones ≠ disaster recovery
Availability Zones protect against a single datacentre failure within one region — that's high availability, not DR. They do not cover a region-wide impairment, a bad deployment, ransomware, or an Entra ID / subscription compromise. Real DR needs cross-region reach: Azure's paired regions (with their sequential update and recovery priorities) plus Azure Site Recovery for critical workloads. State explicitly which threat each layer addresses.
Step 3 — Backups that survive ransomware and audits
- Azure Backup with Geo-Redundant Storage (GRS) and cross-region restore.
- Immutable vaults + soft delete — make backups WORM so an attacker (or a rogue admin) cannot delete your last line of defence.
- Multi-user authorization (MUA) on Recovery Services vaults for destructive operations.
- Key management via Azure Key Vault with a documented recovery path.
- Scheduled restore drills — capture each as evidence; an untested backup is a guess.
Step 4 — The "business" half of Azure BCDR
- Business Continuity Plans (BCP/DRP/IRP) per critical process.
- Crisis communications and incident command.
- Third-party dependency mapping — Azure itself is a critical ICT provider under DORA, as is Microsoft 365 if you depend on it.
- Exercises — tabletop + Azure Site Recovery failover tests (ASR supports non-disruptive test failover — use it and record the result).
Step 5 — Map Azure BCDR to ISO 22301, DORA and NIS2
- ISO 22301 — your Azure DR tiers are clause 8.4 continuity strategies; ASR test failovers are clause 8.5 exercises.
- DORA (Reg. EU 2022/2554) — Azure/Microsoft as an ICT third party in your Register of Information, with an exit strategy and resilience testing (Art. 24-27); documented RTO/RPO for critical functions (Art. 11-12).
- NIS2 (Dir. EU 2022/2555) — backup management, business continuity and crisis management are explicit (Art. 21).
How ResiPlan operationalises BCDR for Azure
ResiPlan is a BCMS designed for this exact mapping:
- BIA-driven RTO/RPO feeding your Azure DR tiering with full traceability.
- AI plan generators drafting Azure-specific BCP/DRP/IRP runbooks.
- CMDB + dependency mapping recording Azure/Microsoft as a critical ICT provider (DORA Register of Information).
- Exercise & maturity modules to plan, run and evidence ASR failover drills.
- Compliance dashboards for DORA, NIS2 and ISO 22301 from one source of truth.
Start here: the DORA readiness checklist and NIS2 compliance checklist, then book a demo to map your Azure estate to a defensible continuity program.
BCDR for Azure isn't an infrastructure checkbox — it's continuity you can prove. ResiPlan turns your Azure resilience into living, audit-ready evidence.